Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Web-19. CSRF Transfer in a Banking App
Mission
This banking app lets a logged-in user transfer money. Check whether CSRF protections exist by seeing if a separate site can trigger a transfer on the victim's behalf.
Hints
Hint 1 Show
Try logging in with user/password123
Hint 2 Show
Check whether the transfer endpoint has CSRF token protection
Hint 3 Show
Try opening a separate page (attacker.html) while logged in